[Актуально] Таб-таргет для любых серверов

@dark · 23.11.2024, 09:56

Цитата:

Сообщение от Diantro

А-а, понял, спасибо! Из соседнего потока так и не получилось вызывать без дисконнектов. Пробовал через critical sections — не зашло.

В итоге нашёл в игре функцию для обработки нажатий клавиш, которая вызывается в главном цикле main, и просто хукнулся к ней.

Теперь работает на PvPWaR-е, не дисконнектит.

Код на C++

Код:

#include <windows.h>

DWORD* obtainTargetableObjectsAddress = (DWORD*)0x005182C9;
size_t targetabeObjectArrayLen = 0xC;

size_t handleKeyboardEventJmpBackAddr = 0x00527EC5;
size_t handleKeyboardEventToHookAddr = 0x00527EB8;


void* teax;
void* tebx;
void* tecx;
void* tedx;
void* tesi;
void* tedi;
void* tebp;
void* tesp;

int index1 = 0;
int index2 = 0;
int index3 = 0;
int index4 = 0;
int index5 = 0;
int index6 = 0;
int index7 = 0;
int index8 = 0;
int index9 = 0;
int index10 = 0;
int index11 = 0;
int index12 = 0;

struct _CGP_MainGame
{
	typedef void* (__thiscall* _SelectTarget)(void* ecx, void* target, int zero);
	_SelectTarget SelectTarget = (_SelectTarget)(0x005234E0);

	void** pThis = (void**)0x23D6B50;
}CGP_MainGame;

void hook(void* toHook, void* ourFunct, int len) {
	if (len < 5) {
		return;
	}

	DWORD curProtection;
	VirtualProtect(toHook, len, PAGE_EXECUTE_READWRITE, &curProtection);


	memset(toHook, 0x90, len);

	DWORD relativeAddress = ((DWORD)ourFunct - (DWORD)toHook) - 5;

	*(BYTE*)toHook = 0xE9;
	*(DWORD*)((DWORD)toHook + 1) = relativeAddress;

	VirtualProtect(toHook, len, curProtection, &curProtection);
}

void select_target(int index, int *innerIndex, _In_ int vKey) {
	if (GetAsyncKeyState(vKey) & 0x8000) {
		DWORD* targetableObjectsPtr = (DWORD*)*obtainTargetableObjectsAddress;

		void*** ptrToFirstTargetableObjectPtr = (void***)(*targetableObjectsPtr + 0xC + 4);
		void*** ptrToLastTargetableObjectPtr = (void***)(*targetableObjectsPtr + 0xC + 8);

		void*** ptrToFirstObjectPtr = (void***)((char*)ptrToFirstTargetableObjectPtr + (index << 4));
		void*** ptrToLastObjectPtr = (void***)((char*)ptrToLastTargetableObjectPtr + (index << 4));

		void** firstObjectPtr = *ptrToFirstObjectPtr;
		void** lastObjectPtr = *ptrToLastObjectPtr;

		void** currentObjectPtr = (void**)((char*)firstObjectPtr + (*innerIndex * 4));

		// If outside the range, reset the index to 0
		if (currentObjectPtr < firstObjectPtr || currentObjectPtr >= lastObjectPtr) {
			*innerIndex = 0;
			currentObjectPtr = (void**)((char*)firstObjectPtr + (*innerIndex * 4));
		}

		if (currentObjectPtr >= lastObjectPtr) { // If it's still the end then the array is empty
			return;
		}

		CGP_MainGame.SelectTarget(*CGP_MainGame.pThis, *currentObjectPtr, 0);

	
		*innerIndex = *innerIndex + 1;
	}
}

void handle_tab_target() {
	select_target(0, &index1, '1'); // Other characters
	select_target(1, &index2, '2'); // Mobs
	select_target(2, &index3, '3'); // NPCs
	select_target(3, &index4, '4');
	select_target(4, &index5, '5');
	select_target(5, &index6, '6');
	select_target(6, &index7, '7');
	select_target(7, &index8, '8');
	select_target(8, &index9, '9');
	select_target(9, &index10, '0');
	select_target(10, &index11, '-');
	select_target(11, &index12, '=');
}

void __declspec(naked) hook_function() {
	__asm {
		mov teax, eax; backup registers
		mov tebx, ebx
		mov tecx, ecx
		mov tedx, edx
		mov tesi, esi
		mov tedi, edi
		mov tebp, ebp
		mov tesp, esp; end of backup
	}

	handle_tab_target();

	__asm {
		mov eax, teax; start to restore registers
		mov ebx, tebx
		mov ecx, tecx
		mov edx, tedx
		mov esi, tesi
		mov edi, tedi
		mov ebp, tebp
		mov esp, tesp; end of restore
		mov edx, dword ptr ss : [ebp - 0x4]
		mov dword ptr ds : [edx + 0x334] , 0
		jmp[handleKeyboardEventJmpBackAddr]
	}
}

DWORD WINAPI injected_thread(HMODULE hModule) {
	hook(reinterpret_cast <void*>(handleKeyboardEventToHookAddr), reinterpret_cast<void*>(hook_function), 13);

	return 0;
}



BOOL WINAPI DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved) {
	switch (ul_reason_for_call) {
		case DLL_PROCESS_ATTACH:
			HANDLE ThreadHandle = CreateThread(0, NULL, (LPTHREAD_START_ROUTINE)injected_thread, hModule, NULL, NULL);

			if (ThreadHandle != NULL) {
				CloseHandle(ThreadHandle);
			}
			break;
		}
	return TRUE;
}

А зачем так регистры бекапить? В х32 есть же pushad/popad

@Diantro · 23.11.2024, 16:08

Цитата:

Сообщение от dark

А зачем так регистры бекапить? В х32 есть же pushad/popad

Да я просто на коленке сделал. Люди делают ctrl+c, ctrl+v, у них не работает, и они начинают писать в ЛС.

Код на C++ (pushad popad)

Код:

#include <windows.h>

DWORD* obtainTargetableObjectsAddress = (DWORD*)0x005182C9;
size_t targetabeObjectArrayLen = 0xC;

size_t handleKeyboardEventJmpBackAddr = 0x00527EC5;
size_t handleKeyboardEventToHookAddr = 0x00527EB8;

int index1 = 0;
int index2 = 0;
int index3 = 0;
int index4 = 0;
int index5 = 0;
int index6 = 0;
int index7 = 0;
int index8 = 0;
int index9 = 0;
int index10 = 0;
int index11 = 0;
int index12 = 0;

struct _CGP_MainGame
{
	typedef void* (__thiscall* _SelectTarget)(void* ecx, void* target, int zero);
	_SelectTarget SelectTarget = (_SelectTarget)(0x005234E0);

	void** pThis = (void**)0x23D6B50;
}CGP_MainGame;

void hook(void* toHook, void* ourFunct, int len) {
	if (len < 5) {
		return;
	}

	DWORD curProtection;
	VirtualProtect(toHook, len, PAGE_EXECUTE_READWRITE, &curProtection);


	memset(toHook, 0x90, len);

	DWORD relativeAddress = ((DWORD)ourFunct - (DWORD)toHook) - 5;

	*(BYTE*)toHook = 0xE9;
	*(DWORD*)((DWORD)toHook + 1) = relativeAddress;

	VirtualProtect(toHook, len, curProtection, &curProtection);
}

void select_target(int index, int *innerIndex, _In_ int vKey) {
	if (GetAsyncKeyState(vKey) & 0x8000) {
		DWORD* targetableObjectsPtr = (DWORD*)*obtainTargetableObjectsAddress;

		void*** ptrToFirstTargetableObjectPtr = (void***)(*targetableObjectsPtr + 0xC + 4);
		void*** ptrToLastTargetableObjectPtr = (void***)(*targetableObjectsPtr + 0xC + 8);

		void*** ptrToFirstObjectPtr = (void***)((char*)ptrToFirstTargetableObjectPtr + (index << 4));
		void*** ptrToLastObjectPtr = (void***)((char*)ptrToLastTargetableObjectPtr + (index << 4));

		void** firstObjectPtr = *ptrToFirstObjectPtr;
		void** lastObjectPtr = *ptrToLastObjectPtr;

		void** currentObjectPtr = (void**)((char*)firstObjectPtr + (*innerIndex * 4));

		// If outside the range, reset the index to 0
		if (currentObjectPtr < firstObjectPtr || currentObjectPtr >= lastObjectPtr) {
			*innerIndex = 0;
			currentObjectPtr = (void**)((char*)firstObjectPtr + (*innerIndex * 4));
		}

		if (currentObjectPtr >= lastObjectPtr) { // If it's still the end then the array is empty
			return;
		}

		CGP_MainGame.SelectTarget(*CGP_MainGame.pThis, *currentObjectPtr, 0);

	
		*innerIndex = *innerIndex + 1;
	}
}

void handle_tab_target() {
	select_target(0, &index1, '1'); // Other characters
	select_target(1, &index2, '2'); // Mobs
	select_target(2, &index3, '3'); // NPCs
	select_target(3, &index4, '4');
	select_target(4, &index5, '5');
	select_target(5, &index6, '6');
	select_target(6, &index7, '7');
	select_target(7, &index8, '8');
	select_target(8, &index9, '9');
	select_target(9, &index10, '0');
	select_target(10, &index11, '-');
	select_target(11, &index12, '=');
}

void __declspec(naked) hook_function() {
	__asm {
		pushad; backup registers
	}

	handle_tab_target();

	__asm {
		popad; restore registers
		mov edx, dword ptr ss : [ebp - 0x4]
		mov dword ptr ds : [edx + 0x334] , 0
		jmp[handleKeyboardEventJmpBackAddr]
	}
}

DWORD WINAPI injected_thread(HMODULE hModule) {
	hook(reinterpret_cast <void*>(handleKeyboardEventToHookAddr), reinterpret_cast<void*>(hook_function), 13);

	return 0;
}



BOOL WINAPI DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved) {
	switch (ul_reason_for_call) {
		case DLL_PROCESS_ATTACH:
			HANDLE ThreadHandle = CreateThread(0, NULL, (LPTHREAD_START_ROUTINE)injected_thread, hModule, NULL, NULL);

			if (ThreadHandle != NULL) {
				CloseHandle(ThreadHandle);
			}
			break;
		}
	return TRUE;
}

@skisss · 23.11.2024, 22:08

Цитата:

Сообщение от Diantro

Да я просто на коленке сделал. Люди делают ctrl+c, ctrl+v, у них не работает, и они начинают писать в ЛС.

Код на C++ (pushad popad)

Код:

#include <windows.h>

DWORD* obtainTargetableObjectsAddress = (DWORD*)0x005182C9;
size_t targetabeObjectArrayLen = 0xC;

size_t handleKeyboardEventJmpBackAddr = 0x00527EC5;
size_t handleKeyboardEventToHookAddr = 0x00527EB8;

int index1 = 0;
int index2 = 0;
int index3 = 0;
int index4 = 0;
int index5 = 0;
int index6 = 0;
int index7 = 0;
int index8 = 0;
int index9 = 0;
int index10 = 0;
int index11 = 0;
int index12 = 0;

struct _CGP_MainGame
{
	typedef void* (__thiscall* _SelectTarget)(void* ecx, void* target, int zero);
	_SelectTarget SelectTarget = (_SelectTarget)(0x005234E0);

	void** pThis = (void**)0x23D6B50;
}CGP_MainGame;

void hook(void* toHook, void* ourFunct, int len) {
	if (len < 5) {
		return;
	}

	DWORD curProtection;
	VirtualProtect(toHook, len, PAGE_EXECUTE_READWRITE, &curProtection);


	memset(toHook, 0x90, len);

	DWORD relativeAddress = ((DWORD)ourFunct - (DWORD)toHook) - 5;

	*(BYTE*)toHook = 0xE9;
	*(DWORD*)((DWORD)toHook + 1) = relativeAddress;

	VirtualProtect(toHook, len, curProtection, &curProtection);
}

void select_target(int index, int *innerIndex, _In_ int vKey) {
	if (GetAsyncKeyState(vKey) & 0x8000) {
		DWORD* targetableObjectsPtr = (DWORD*)*obtainTargetableObjectsAddress;

		void*** ptrToFirstTargetableObjectPtr = (void***)(*targetableObjectsPtr + 0xC + 4);
		void*** ptrToLastTargetableObjectPtr = (void***)(*targetableObjectsPtr + 0xC + 8);

		void*** ptrToFirstObjectPtr = (void***)((char*)ptrToFirstTargetableObjectPtr + (index << 4));
		void*** ptrToLastObjectPtr = (void***)((char*)ptrToLastTargetableObjectPtr + (index << 4));

		void** firstObjectPtr = *ptrToFirstObjectPtr;
		void** lastObjectPtr = *ptrToLastObjectPtr;

		void** currentObjectPtr = (void**)((char*)firstObjectPtr + (*innerIndex * 4));

		// If outside the range, reset the index to 0
		if (currentObjectPtr < firstObjectPtr || currentObjectPtr >= lastObjectPtr) {
			*innerIndex = 0;
			currentObjectPtr = (void**)((char*)firstObjectPtr + (*innerIndex * 4));
		}

		if (currentObjectPtr >= lastObjectPtr) { // If it's still the end then the array is empty
			return;
		}

		CGP_MainGame.SelectTarget(*CGP_MainGame.pThis, *currentObjectPtr, 0);

	
		*innerIndex = *innerIndex + 1;
	}
}

void handle_tab_target() {
	select_target(0, &index1, '1'); // Other characters
	select_target(1, &index2, '2'); // Mobs
	select_target(2, &index3, '3'); // NPCs
	select_target(3, &index4, '4');
	select_target(4, &index5, '5');
	select_target(5, &index6, '6');
	select_target(6, &index7, '7');
	select_target(7, &index8, '8');
	select_target(8, &index9, '9');
	select_target(9, &index10, '0');
	select_target(10, &index11, '-');
	select_target(11, &index12, '=');
}

void __declspec(naked) hook_function() {
	__asm {
		pushad; backup registers
	}

	handle_tab_target();

	__asm {
		popad; restore registers
		mov edx, dword ptr ss : [ebp - 0x4]
		mov dword ptr ds : [edx + 0x334] , 0
		jmp[handleKeyboardEventJmpBackAddr]
	}
}

DWORD WINAPI injected_thread(HMODULE hModule) {
	hook(reinterpret_cast <void*>(handleKeyboardEventToHookAddr), reinterpret_cast<void*>(hook_function), 13);

	return 0;
}



BOOL WINAPI DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved) {
	switch (ul_reason_for_call) {
		case DLL_PROCESS_ATTACH:
			HANDLE ThreadHandle = CreateThread(0, NULL, (LPTHREAD_START_ROUTINE)injected_thread, hModule, NULL, NULL);

			if (ThreadHandle != NULL) {
				CloseHandle(ThreadHandle);
			}
			break;
		}
	return TRUE;
}

гайд как заставить одной темой на форуме все говнофришки перейти на внутриигровой таб таргет